Getting "Access someone elses basket" award only seems to work for Guest User

psiinon / bodgeit

The BodgeIt Store is a vulnerable web application which is currently aimed at people who are new to pen testing.

263 stars 195 forks source link

Getting "Access someone elses basket" award only seems to work for Guest User #7

Open GoogleCodeExporter opened 9 years ago

GoogleCodeExporter commented 9 years ago

When logged in as some user and tampering with the b_id cookie to see another 
users cart, this seems not to be counted as a passed challenge.

The challenge seems only to be passed (=green ball) when doing to as Guest User.

Original issue reported on code.google.com by bjoern.k...@gmx.de on 9 Aug 2013 at 8:10